MexicoDecree on Safe Digital Environments for Children and Adolescents
In force since .
An age-appropriate design code rule binding private bodies.
As of .
What it requires
- Do not allow a child or adolescent access to, exposure to or a recommendation of content, especially images and videos, that generates or promotes harassment, sexual abuse or exploitation, hate or violent extremism, unlawful conduct, pornography or other explicit sexual material, or suicide, self-harm and eating disorders (Article 3).no control in the NIST Privacy Framework
- Implement reliable and secure mechanisms to identify the age of your users; they must not be limited to the user's self-declaration of age (Article 4, item I).no control in the NIST Privacy Framework
- Publish the criteria for identifying and removing accounts or content that promote an Article 3 prohibition and the criteria for age classification and content moderation by user age, and enable the technical mechanisms to apply them (Article 4, items II and III).no control in the NIST Privacy Framework
- Identify and remove immediately any account or content that generates or promotes an Article 3 prohibition, and provide accessible, visible and permanently available mechanisms for users to report them (Article 4, items IV and V).no control in the NIST Privacy Framework
- Provide mechanisms for parents or guardians to supervise minors' accounts, guarantee safety and protection of children and adolescents by design, and keep the strictest available privacy and safety settings active by default when a new account is created (Article 4, items VI to VIII).NIST Privacy FrameworkGV.PO-P2
- Carry out periodic assessments of the risks that design, features, recommender systems, user interaction and service characteristics pose to children and adolescents, adopt reasonable measures to prevent or mitigate them, and share statistical reports on the patterns detected in Article 3 content with the competent authorities periodically (Article 4, item IX).NIST Privacy FrameworkID.RA-P4
- Designate a direct, specialized contact point for justice authorities, available 24 hours a day and 365 days a year, with immediate technical capacity to act on user-generated content (Article 5, item I).no control in the NIST Privacy Framework
- When an account or content is removed, preserve any digital evidence for at least 90 business days (Article 5, item II).NIST Privacy FrameworkCT.PO-P2
- Inform and alert the competent national authorities immediately of accounts or content that threaten the life, dignity, safety, integrity or privacy of children and adolescents (Article 5, item III).no control in the NIST Privacy Framework
- Document and report the actions implemented to comply with the decree within a maximum of thirty calendar days from its entry into force (fourth transitory provision).no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it reaches
Covered services
Digital platforms: Internet intermediary services that let users interact, communicate and create, share or distribute content, including social networks, video games and app stores
Obligation class
Prohibition, Age verification, Design code, DPIA, Reporting, Retention
What this law does
The President signed the decree in Mexico City on . The Diario Oficial de la Federación published the decree on , in its evening edition. The decree takes effect on the day of its publication in the Diario Oficial de la Federación. Under the fourth transitory provision, digital platforms must document and report the actions they have implemented to comply within a maximum of thirty calendar days from the decree's entry into force.
Article 2 defines a digital platform as a digital service provided by intermediaries over the Internet that lets users interact, communicate and create, share or distribute content, including social networks, video games and app stores.
Article 3 prohibits a digital platform from allowing a child or adolescent access to, exposure to or a recommendation of content in seven listed categories, including harassment and cyberbullying, sexual abuse and exploitation, hate speech and violent extremism, pornography and other explicit sexual material, and suicide, self-harm and eating disorders.
Article 4, item I, requires each digital platform to implement reliable and secure mechanisms to identify the age of its users, which must not be limited to the user's self-declaration of age.
Article 4, items II to V, require a digital platform to publish its criteria for identifying and removing accounts or content that promote an Article 3 prohibition and its criteria for age classification and content moderation, to remove such accounts and content immediately, and to provide accessible, visible and permanently available reporting mechanisms.
Article 4, items VI to VIII, require a digital platform to provide parental supervision of minors' accounts, to guarantee safety and protection by design, and to keep the strictest available privacy and safety settings active by default when a new account is created.
Article 4, item IX, requires a digital platform to carry out periodic assessments of the risks that its design, features, recommender systems and user interaction pose to children and adolescents, to adopt reasonable measures to prevent or mitigate them, and to share statistical reports on the Article 3 content patterns it detects with the competent authorities.
Article 5 requires a digital platform to designate a direct, specialized contact point for justice authorities that is available 24 hours a day, every day of the year. When an account or content is removed, a digital platform must preserve any digital evidence for at least 90 business days. A digital platform must also immediately inform and alert the competent national authorities of accounts or content that threaten the life, dignity, safety, integrity or privacy of children and adolescents.
Article 6 directs the Secretaría de Salud to design and implement mental-health strategies and programs for children and adolescents.
When LexLint raises it
When your app profile says your app serves under-18s, operates a social platform or operates an app store.